CVE-2026-58865: Android Framework Base Denial of Service Vulnerability in PduParser
Summary
CVE-2026-58865: In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. Affects platform/frameworks/base across 6 version ranges.
>= 14:0, < 14:2026-10-01
>= 15:0, < 15:2026-10-01
>= 16:0, < 16:2026-10-01
>= 16-qpr2:0, < 16-qpr2:2026-10-01
>= 17:0, < 17:2026-10-01
>= 17-next:0, < 17-next:2026-10-01
Fixed in 17-next:2026-10-01. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Android Framework Base is a core component of the Android operating system, providing essential functionalities for application development and system operations. It includes various libraries and APIs that facilitate communication, user interface management, and data handling. The PduParser.java file is responsible for parsing multimedia messaging service (MMS) data, which is critical for handling multimedia content in messages. This vulnerability exposes the framework to potential denial of service attacks, impacting the stability and availability of applications relying on these services.
Vulnerability Detail
In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This vulnerability allows an attacker to exploit the parsing functions without requiring any additional execution privileges or user interaction. The lack of proper input validation can lead to resource exhaustion, causing the application or service to become unresponsive, thereby affecting the overall user experience and system reliability.
How To Fix
Minimum fixed version
17-next:2026-10-01
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement input validation checks in your application to ensure that the data being parsed does not exceed expected bounds. This can help mitigate the risk of denial of service attacks until the framework is updated. For example, you can add checks in your parsing logic to limit the size of the input data before processing it.
Conclusion
The CVE-2026-58865 vulnerability in the Android Framework Base poses a significant risk of denial of service attacks due to missing bounds checks in the PduParser.java file. It is crucial for developers to update their packages to the latest versions and implement necessary input validation to protect their applications from potential exploitation.
See every vulnerability recorded for platform/frameworks/base →
FAQ
CVE-2026-58865 is a vulnerability in the Android Framework Base that allows for a denial of service attack due to improper input validation in the PduParser.java file.
Exploitation of this vulnerability can lead to resource exhaustion, causing your application to become unresponsive, which negatively impacts user experience.
No, user interaction is not needed for exploitation, making it easier for attackers to target vulnerable applications.
You can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Update your Android Framework Base package to the latest patched version and implement input validation checks in your application to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for platform/frameworks/base.
